1 /*

     2  * reserved comment block

     3  * DO NOT REMOVE OR ALTER!

     4  */

     5 /**

     6  * Licensed to the Apache Software Foundation (ASF) under one

     7  * or more contributor license agreements. See the NOTICE file

     8  * distributed with this work for additional information

     9  * regarding copyright ownership. The ASF licenses this file

    10  * to you under the Apache License, Version 2.0 (the

    11  * "License"); you may not use this file except in compliance

    12  * with the License. You may obtain a copy of the License at

    13  *

    14  * http://www.apache.org/licenses/LICENSE-2.0

    15  *

    16  * Unless required by applicable law or agreed to in writing,

    17  * software distributed under the License is distributed on an

    18  * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY

    19  * KIND, either express or implied. See the License for the

    20  * specific language governing permissions and limitations

    21  * under the License.

    22  */

    23 package com.sun.org.apache.xml.internal.security.encryption;

    24 

    25 import java.io.ByteArrayOutputStream;

    26 import java.io.InputStream;

    27 import java.io.UnsupportedEncodingException;

    28 import java.net.URI;

    29 import java.net.URISyntaxException;

    30 import java.security.InvalidAlgorithmParameterException;

    31 import java.security.InvalidKeyException;

    32 import java.security.Key;

    33 import java.security.NoSuchAlgorithmException;

    34 import java.security.NoSuchProviderException;

    35 import java.security.SecureRandom;

    36 import java.security.spec.MGF1ParameterSpec;

    37 import java.util.ArrayList;

    38 import java.util.HashMap;

    39 import java.util.Iterator;

    40 import java.util.LinkedList;

    41 import java.util.List;

    42 import java.util.Map;

    43 

    44 import javax.crypto.BadPaddingException;

    45 import javax.crypto.Cipher;

    46 import javax.crypto.IllegalBlockSizeException;

    47 import javax.crypto.NoSuchPaddingException;

    48 import javax.crypto.spec.IvParameterSpec;

    49 import javax.crypto.spec.OAEPParameterSpec;

    50 import javax.crypto.spec.PSource;

    51 

    52 import com.sun.org.apache.xml.internal.security.algorithms.JCEMapper;

    53 import com.sun.org.apache.xml.internal.security.algorithms.MessageDigestAlgorithm;

    54 import com.sun.org.apache.xml.internal.security.c14n.Canonicalizer;

    55 import com.sun.org.apache.xml.internal.security.c14n.InvalidCanonicalizerException;

    56 import com.sun.org.apache.xml.internal.security.exceptions.Base64DecodingException;

    57 import com.sun.org.apache.xml.internal.security.exceptions.XMLSecurityException;

    58 import com.sun.org.apache.xml.internal.security.keys.KeyInfo;

    59 import com.sun.org.apache.xml.internal.security.keys.keyresolver.KeyResolverException;

    60 import com.sun.org.apache.xml.internal.security.keys.keyresolver.KeyResolverSpi;

    61 import com.sun.org.apache.xml.internal.security.keys.keyresolver.implementations.EncryptedKeyResolver;

    62 import com.sun.org.apache.xml.internal.security.signature.XMLSignatureException;

    63 import com.sun.org.apache.xml.internal.security.transforms.InvalidTransformException;

    64 import com.sun.org.apache.xml.internal.security.transforms.TransformationException;

    65 import com.sun.org.apache.xml.internal.security.utils.Base64;

    66 import com.sun.org.apache.xml.internal.security.utils.Constants;

    67 import com.sun.org.apache.xml.internal.security.utils.ElementProxy;

    68 import com.sun.org.apache.xml.internal.security.utils.EncryptionConstants;

    69 import com.sun.org.apache.xml.internal.security.utils.XMLUtils;

    70 import org.w3c.dom.Attr;

    71 import org.w3c.dom.Document;

    72 import org.w3c.dom.Element;

    73 import org.w3c.dom.Node;

    74 import org.w3c.dom.NodeList;

    75 

    76 /**

    77  * <code>XMLCipher</code> encrypts and decrypts the contents of

    78  * <code>Document</code>s, <code>Element</code>s and <code>Element</code>

    79  * contents. It was designed to resemble <code>javax.crypto.Cipher</code> in

    80  * order to facilitate understanding of its functioning.

    81  *

    82  * @author Axl Mattheus (Sun Microsystems)

    83  * @author Christian Geuer-Pollmann

    84  */

    85 public class XMLCipher {

    86 

    87     private static java.util.logging.Logger log =

    88         java.util.logging.Logger.getLogger(XMLCipher.class.getName());

    89 

    90     /** Triple DES EDE (192 bit key) in CBC mode */

    91     public static final String TRIPLEDES =

    92         EncryptionConstants.ALGO_ID_BLOCKCIPHER_TRIPLEDES;

    93 

    94     /** AES 128 Cipher */

    95     public static final String AES_128 =

    96         EncryptionConstants.ALGO_ID_BLOCKCIPHER_AES128;

    97 

    98     /** AES 256 Cipher */

    99     public static final String AES_256 =

   100         EncryptionConstants.ALGO_ID_BLOCKCIPHER_AES256;

   101 

   102     /** AES 192 Cipher */

   103     public static final String AES_192 =

   104         EncryptionConstants.ALGO_ID_BLOCKCIPHER_AES192;

   105 

   106     /** AES 128 GCM Cipher */

   107     public static final String AES_128_GCM =

   108         EncryptionConstants.ALGO_ID_BLOCKCIPHER_AES128_GCM;

   109 

   110     /** AES 192 GCM Cipher */

   111     public static final String AES_192_GCM =

   112         EncryptionConstants.ALGO_ID_BLOCKCIPHER_AES192_GCM;

   113 

   114     /** AES 256 GCM Cipher */

   115     public static final String AES_256_GCM =

   116         EncryptionConstants.ALGO_ID_BLOCKCIPHER_AES256_GCM;

   117 

   118     /** RSA 1.5 Cipher */

   119     public static final String RSA_v1dot5 =

   120         EncryptionConstants.ALGO_ID_KEYTRANSPORT_RSA15;

   121 

   122     /** RSA OAEP Cipher */

   123     public static final String RSA_OAEP =

   124         EncryptionConstants.ALGO_ID_KEYTRANSPORT_RSAOAEP;

   125 

   126     /** RSA OAEP Cipher */

   127     public static final String RSA_OAEP_11 =

   128         EncryptionConstants.ALGO_ID_KEYTRANSPORT_RSAOAEP_11;

   129 

   130     /** DIFFIE_HELLMAN Cipher */

   131     public static final String DIFFIE_HELLMAN =

   132         EncryptionConstants.ALGO_ID_KEYAGREEMENT_DH;

   133 

   134     /** Triple DES EDE (192 bit key) in CBC mode KEYWRAP*/

   135     public static final String TRIPLEDES_KeyWrap =

   136         EncryptionConstants.ALGO_ID_KEYWRAP_TRIPLEDES;

   137 

   138     /** AES 128 Cipher KeyWrap */

   139     public static final String AES_128_KeyWrap =

   140         EncryptionConstants.ALGO_ID_KEYWRAP_AES128;

   141 

   142     /** AES 256 Cipher KeyWrap */

   143     public static final String AES_256_KeyWrap =

   144         EncryptionConstants.ALGO_ID_KEYWRAP_AES256;

   145 

   146     /** AES 192 Cipher KeyWrap */

   147     public static final String AES_192_KeyWrap =

   148         EncryptionConstants.ALGO_ID_KEYWRAP_AES192;

   149 

   150     /** SHA1 Cipher */

   151     public static final String SHA1 =

   152         Constants.ALGO_ID_DIGEST_SHA1;

   153 

   154     /** SHA256 Cipher */

   155     public static final String SHA256 =

   156         MessageDigestAlgorithm.ALGO_ID_DIGEST_SHA256;

   157 

   158     /** SHA512 Cipher */

   159     public static final String SHA512 =

   160         MessageDigestAlgorithm.ALGO_ID_DIGEST_SHA512;

   161 

   162     /** RIPEMD Cipher */

   163     public static final String RIPEMD_160 =

   164         MessageDigestAlgorithm.ALGO_ID_DIGEST_RIPEMD160;

   165 

   166     /** XML Signature NS */

   167     public static final String XML_DSIG =

   168         Constants.SignatureSpecNS;

   169 

   170     /** N14C_XML */

   171     public static final String N14C_XML =

   172         Canonicalizer.ALGO_ID_C14N_OMIT_COMMENTS;

   173 

   174     /** N14C_XML with comments*/

   175     public static final String N14C_XML_WITH_COMMENTS =

   176         Canonicalizer.ALGO_ID_C14N_WITH_COMMENTS;

   177 

   178     /** N14C_XML exclusive */

   179     public static final String EXCL_XML_N14C =

   180         Canonicalizer.ALGO_ID_C14N_EXCL_OMIT_COMMENTS;

   181 

   182     /** N14C_XML exclusive with comments*/

   183     public static final String EXCL_XML_N14C_WITH_COMMENTS =

   184         Canonicalizer.ALGO_ID_C14N_EXCL_WITH_COMMENTS;

   185 

   186     /** N14C_PHYSICAL preserve the physical representation*/

   187     public static final String PHYSICAL_XML_N14C =

   188         Canonicalizer.ALGO_ID_C14N_PHYSICAL;

   189 

   190     /** Base64 encoding */

   191     public static final String BASE64_ENCODING =

   192         com.sun.org.apache.xml.internal.security.transforms.Transforms.TRANSFORM_BASE64_DECODE;

   193 

   194     /** ENCRYPT Mode */

   195     public static final int ENCRYPT_MODE = Cipher.ENCRYPT_MODE;

   196 

   197     /** DECRYPT Mode */

   198     public static final int DECRYPT_MODE = Cipher.DECRYPT_MODE;

   199 

   200     /** UNWRAP Mode */

   201     public static final int UNWRAP_MODE  = Cipher.UNWRAP_MODE;

   202 

   203     /** WRAP Mode */

   204     public static final int WRAP_MODE    = Cipher.WRAP_MODE;

   205 

   206     private static final String ENC_ALGORITHMS = TRIPLEDES + "\n" +

   207     AES_128 + "\n" + AES_256 + "\n" + AES_192 + "\n" + RSA_v1dot5 + "\n" +

   208     RSA_OAEP + "\n" + RSA_OAEP_11 + "\n" + TRIPLEDES_KeyWrap + "\n" +

   209     AES_128_KeyWrap + "\n" + AES_256_KeyWrap + "\n" + AES_192_KeyWrap + "\n" +

   210     AES_128_GCM + "\n" + AES_192_GCM + "\n" + AES_256_GCM + "\n";

   211 

   212     /** Cipher created during initialisation that is used for encryption */

   213     private Cipher contextCipher;

   214 

   215     /** Mode that the XMLCipher object is operating in */

   216     private int cipherMode = Integer.MIN_VALUE;

   217 

   218     /** URI of algorithm that is being used for cryptographic operation */

   219     private String algorithm = null;

   220 

   221     /** Cryptographic provider requested by caller */

   222     private String requestedJCEProvider = null;

   223 

   224     /** Holds c14n to serialize, if initialized then _always_ use this c14n to serialize */

   225     private Canonicalizer canon;

   226 

   227     /** Used for creation of DOM nodes in WRAP and ENCRYPT modes */

   228     private Document contextDocument;

   229 

   230     /** Instance of factory used to create XML Encryption objects */

   231     private Factory factory;

   232 

   233     /** Serializer class for going to/from UTF-8 */

   234     private Serializer serializer;

   235 

   236     /** Local copy of user's key */

   237     private Key key;

   238 

   239     /** Local copy of the kek (used to decrypt EncryptedKeys during a

   240      *  DECRYPT_MODE operation */

   241     private Key kek;

   242 

   243     // The EncryptedKey being built (part of a WRAP operation) or read

   244     // (part of an UNWRAP operation)

   245     private EncryptedKey ek;

   246 

   247     // The EncryptedData being built (part of a WRAP operation) or read

   248     // (part of an UNWRAP operation)

   249     private EncryptedData ed;

   250 

   251     private SecureRandom random;

   252 

   253     private boolean secureValidation;

   254 

   255     private String digestAlg;

   256 

   257     /** List of internal KeyResolvers for DECRYPT and UNWRAP modes. */

   258     private List<KeyResolverSpi> internalKeyResolvers;

   259 

   260     /**

   261      * Set the Serializer algorithm to use

   262      */

   263     public void setSerializer(Serializer serializer) {

   264         this.serializer = serializer;

   265         serializer.setCanonicalizer(this.canon);

   266     }

   267 

   268     /**

   269      * Get the Serializer algorithm to use

   270      */

   271     public Serializer getSerializer() {

   272         return serializer;

   273     }

   274 

   275     /**

   276      * Creates a new <code>XMLCipher</code>.

   277      *

   278      * @param transformation    the name of the transformation, e.g.,

   279      *                          <code>XMLCipher.TRIPLEDES</code>. If null the XMLCipher can only

   280      *                          be used for decrypt or unwrap operations where the encryption method

   281      *                          is defined in the <code>EncryptionMethod</code> element.

   282      * @param provider          the JCE provider that supplies the transformation,

   283      *                          if null use the default provider.

   284      * @param canon             the name of the c14n algorithm, if

   285      *                          <code>null</code> use standard serializer

   286      * @param digestMethod      An optional digestMethod to use.

   287      */

   288     private XMLCipher(

   289         String transformation,

   290         String provider,

   291         String canonAlg,

   292         String digestMethod

   293     ) throws XMLEncryptionException {

   294         if (log.isLoggable(java.util.logging.Level.FINE)) {

   295             log.log(java.util.logging.Level.FINE, "Constructing XMLCipher...");

   296         }

   297 

   298         factory = new Factory();

   299 

   300         algorithm = transformation;

   301         requestedJCEProvider = provider;

   302         digestAlg = digestMethod;

   303 

   304         // Create a canonicalizer - used when serializing DOM to octets

   305         // prior to encryption (and for the reverse)

   306 

   307         try {

   308             if (canonAlg == null) {

   309                 // The default is to preserve the physical representation.

   310                 this.canon = Canonicalizer.getInstance(Canonicalizer.ALGO_ID_C14N_PHYSICAL);

   311             } else {

   312                 this.canon = Canonicalizer.getInstance(canonAlg);

   313             }

   314         } catch (InvalidCanonicalizerException ice) {

   315             throw new XMLEncryptionException("empty", ice);

   316         }

   317 

   318         if (serializer == null) {

   319             serializer = new DocumentSerializer();

   320         }

   321         serializer.setCanonicalizer(this.canon);

   322 

   323         if (transformation != null) {

   324             contextCipher = constructCipher(transformation, digestMethod);

   325         }

   326     }

   327 

   328     /**

   329      * Checks to ensure that the supplied algorithm is valid.

   330      *

   331      * @param algorithm the algorithm to check.

   332      * @return true if the algorithm is valid, otherwise false.

   333      * @since 1.0.

   334      */

   335     private static boolean isValidEncryptionAlgorithm(String algorithm) {

   336         return (

   337             algorithm.equals(TRIPLEDES) ||

   338             algorithm.equals(AES_128) ||

   339             algorithm.equals(AES_256) ||

   340             algorithm.equals(AES_192) ||

   341             algorithm.equals(AES_128_GCM) ||

   342             algorithm.equals(AES_192_GCM) ||

   343             algorithm.equals(AES_256_GCM) ||

   344             algorithm.equals(RSA_v1dot5) ||

   345             algorithm.equals(RSA_OAEP) ||

   346             algorithm.equals(RSA_OAEP_11) ||

   347             algorithm.equals(TRIPLEDES_KeyWrap) ||

   348             algorithm.equals(AES_128_KeyWrap) ||

   349             algorithm.equals(AES_256_KeyWrap) ||

   350             algorithm.equals(AES_192_KeyWrap)

   351         );

   352     }

   353 

   354     /**

   355      * Validate the transformation argument of getInstance or getProviderInstance

   356      *

   357      * @param transformation the name of the transformation, e.g.,

   358      *   <code>XMLCipher.TRIPLEDES</code> which is shorthand for

   359      *   "http://www.w3.org/2001/04/xmlenc#tripledes-cbc"

   360      */

   361     private static void validateTransformation(String transformation) {

   362         if (null == transformation) {

   363             throw new NullPointerException("Transformation unexpectedly null...");

   364         }

   365         if (!isValidEncryptionAlgorithm(transformation)) {

   366             log.log(java.util.logging.Level.WARNING, "Algorithm non-standard, expected one of " + ENC_ALGORITHMS);

   367         }

   368     }

   369 

   370     /**

   371      * Returns an <code>XMLCipher</code> that implements the specified

   372      * transformation and operates on the specified context document.

   373      * <p>

   374      * If the default provider package supplies an implementation of the

   375      * requested transformation, an instance of Cipher containing that

   376      * implementation is returned. If the transformation is not available in

   377      * the default provider package, other provider packages are searched.

   378      * <p>

   379      * <b>NOTE<sub>1</sub>:</b> The transformation name does not follow the same

   380      * pattern as that outlined in the Java Cryptography Extension Reference

   381      * Guide but rather that specified by the XML Encryption Syntax and

   382      * Processing document. The rational behind this is to make it easier for a

   383      * novice at writing Java Encryption software to use the library.

   384      * <p>

   385      * <b>NOTE<sub>2</sub>:</b> <code>getInstance()</code> does not follow the

   386      * same pattern regarding exceptional conditions as that used in

   387      * <code>javax.crypto.Cipher</code>. Instead, it only throws an

   388      * <code>XMLEncryptionException</code> which wraps an underlying exception.

   389      * The stack trace from the exception should be self explanatory.

   390      *

   391      * @param transformation the name of the transformation, e.g.,

   392      *   <code>XMLCipher.TRIPLEDES</code> which is shorthand for

   393      *   "http://www.w3.org/2001/04/xmlenc#tripledes-cbc"

   394      * @throws XMLEncryptionException

   395      * @return the XMLCipher

   396      * @see javax.crypto.Cipher#getInstance(java.lang.String)

   397      */

   398     public static XMLCipher getInstance(String transformation) throws XMLEncryptionException {

   399         if (log.isLoggable(java.util.logging.Level.FINE)) {

   400             log.log(java.util.logging.Level.FINE, "Getting XMLCipher with transformation");

   401         }

   402         validateTransformation(transformation);

   403         return new XMLCipher(transformation, null, null, null);

   404     }

   405 

   406     /**

   407      * Returns an <code>XMLCipher</code> that implements the specified

   408      * transformation, operates on the specified context document and serializes

   409      * the document with the specified canonicalization algorithm before it

   410      * encrypts the document.

   411      * <p>

   412      *

   413      * @param transformation    the name of the transformation

   414      * @param canon             the name of the c14n algorithm, if <code>null</code> use

   415      *                          standard serializer

   416      * @return the XMLCipher

   417      * @throws XMLEncryptionException

   418      */

   419     public static XMLCipher getInstance(String transformation, String canon)

   420         throws XMLEncryptionException {

   421         if (log.isLoggable(java.util.logging.Level.FINE)) {

   422             log.log(java.util.logging.Level.FINE, "Getting XMLCipher with transformation and c14n algorithm");

   423         }

   424         validateTransformation(transformation);

   425         return new XMLCipher(transformation, null, canon, null);

   426     }

   427 

   428     /**

   429      * Returns an <code>XMLCipher</code> that implements the specified

   430      * transformation, operates on the specified context document and serializes

   431      * the document with the specified canonicalization algorithm before it

   432      * encrypts the document.

   433      * <p>

   434      *

   435      * @param transformation    the name of the transformation

   436      * @param canon             the name of the c14n algorithm, if <code>null</code> use

   437      *                          standard serializer

   438      * @param digestMethod      An optional digestMethod to use

   439      * @return the XMLCipher

   440      * @throws XMLEncryptionException

   441      */

   442     public static XMLCipher getInstance(String transformation, String canon, String digestMethod)

   443         throws XMLEncryptionException {

   444         if (log.isLoggable(java.util.logging.Level.FINE)) {

   445             log.log(java.util.logging.Level.FINE, "Getting XMLCipher with transformation and c14n algorithm");

   446         }

   447         validateTransformation(transformation);

   448         return new XMLCipher(transformation, null, canon, digestMethod);

   449     }

   450 

   451     /**

   452      * Returns an <code>XMLCipher</code> that implements the specified

   453      * transformation and operates on the specified context document.

   454      *

   455      * @param transformation    the name of the transformation

   456      * @param provider          the JCE provider that supplies the transformation

   457      * @return the XMLCipher

   458      * @throws XMLEncryptionException

   459      */

   460     public static XMLCipher getProviderInstance(String transformation, String provider)

   461         throws XMLEncryptionException {

   462         if (log.isLoggable(java.util.logging.Level.FINE)) {

   463             log.log(java.util.logging.Level.FINE, "Getting XMLCipher with transformation and provider");

   464         }

   465         if (null == provider) {

   466             throw new NullPointerException("Provider unexpectedly null..");

   467         }

   468         validateTransformation(transformation);

   469         return new XMLCipher(transformation, provider, null, null);

   470     }

   471 

   472     /**

   473      * Returns an <code>XMLCipher</code> that implements the specified

   474      * transformation, operates on the specified context document and serializes

   475      * the document with the specified canonicalization algorithm before it

   476      * encrypts the document.

   477      * <p>

   478      *

   479      * @param transformation    the name of the transformation

   480      * @param provider          the JCE provider that supplies the transformation

   481      * @param canon             the name of the c14n algorithm, if <code>null</code> use standard

   482      *                          serializer

   483      * @return the XMLCipher

   484      * @throws XMLEncryptionException

   485      */

   486     public static XMLCipher getProviderInstance(

   487         String transformation, String provider, String canon

   488     ) throws XMLEncryptionException {

   489         if (log.isLoggable(java.util.logging.Level.FINE)) {

   490             log.log(java.util.logging.Level.FINE, "Getting XMLCipher with transformation, provider and c14n algorithm");

   491         }

   492         if (null == provider) {

   493             throw new NullPointerException("Provider unexpectedly null..");

   494         }

   495         validateTransformation(transformation);

   496         return new XMLCipher(transformation, provider, canon, null);

   497     }

   498 

   499     /**

   500      * Returns an <code>XMLCipher</code> that implements the specified

   501      * transformation, operates on the specified context document and serializes

   502      * the document with the specified canonicalization algorithm before it

   503      * encrypts the document.

   504      * <p>

   505      *

   506      * @param transformation    the name of the transformation

   507      * @param provider          the JCE provider that supplies the transformation

   508      * @param canon             the name of the c14n algorithm, if <code>null</code> use standard

   509      *                          serializer

   510      * @param digestMethod      An optional digestMethod to use

   511      * @return the XMLCipher

   512      * @throws XMLEncryptionException

   513      */

   514     public static XMLCipher getProviderInstance(

   515         String transformation, String provider, String canon, String digestMethod

   516     ) throws XMLEncryptionException {

   517         if (log.isLoggable(java.util.logging.Level.FINE)) {

   518             log.log(java.util.logging.Level.FINE, "Getting XMLCipher with transformation, provider and c14n algorithm");

   519         }

   520         if (null == provider) {

   521             throw new NullPointerException("Provider unexpectedly null..");

   522         }

   523         validateTransformation(transformation);

   524         return new XMLCipher(transformation, provider, canon, digestMethod);

   525     }

   526 

   527     /**

   528      * Returns an <code>XMLCipher</code> that implements no specific

   529      * transformation, and can therefore only be used for decrypt or

   530      * unwrap operations where the encryption method is defined in the

   531      * <code>EncryptionMethod</code> element.

   532      *

   533      * @return The XMLCipher

   534      * @throws XMLEncryptionException

   535      */

   536     public static XMLCipher getInstance() throws XMLEncryptionException {

   537         if (log.isLoggable(java.util.logging.Level.FINE)) {

   538             log.log(java.util.logging.Level.FINE, "Getting XMLCipher with no arguments");

   539         }

   540         return new XMLCipher(null, null, null, null);

   541     }

   542 

   543     /**

   544      * Returns an <code>XMLCipher</code> that implements no specific

   545      * transformation, and can therefore only be used for decrypt or

   546      * unwrap operations where the encryption method is defined in the

   547      * <code>EncryptionMethod</code> element.

   548      *

   549      * Allows the caller to specify a provider that will be used for

   550      * cryptographic operations.

   551      *

   552      * @param provider          the JCE provider that supplies the transformation

   553      * @return the XMLCipher

   554      * @throws XMLEncryptionException

   555      */

   556     public static XMLCipher getProviderInstance(String provider) throws XMLEncryptionException {

   557         if (log.isLoggable(java.util.logging.Level.FINE)) {

   558             log.log(java.util.logging.Level.FINE, "Getting XMLCipher with provider");

   559         }

   560         return new XMLCipher(null, provider, null, null);

   561     }

   562 

   563     /**

   564      * Initializes this cipher with a key.

   565      * <p>

   566      * The cipher is initialized for one of the following four operations:

   567      * encryption, decryption, key wrapping or key unwrapping, depending on the

   568      * value of opmode.

   569      *

   570      * For WRAP and ENCRYPT modes, this also initialises the internal

   571      * EncryptedKey or EncryptedData (with a CipherValue)

   572      * structure that will be used during the ensuing operations.  This

   573      * can be obtained (in order to modify KeyInfo elements etc. prior to

   574      * finalising the encryption) by calling

   575      * {@link #getEncryptedData} or {@link #getEncryptedKey}.

   576      *

   577      * @param opmode the operation mode of this cipher (this is one of the

   578      *   following: ENCRYPT_MODE, DECRYPT_MODE, WRAP_MODE or UNWRAP_MODE)

   579      * @param key

   580      * @see javax.crypto.Cipher#init(int, java.security.Key)

   581      * @throws XMLEncryptionException

   582      */

   583     public void init(int opmode, Key key) throws XMLEncryptionException {

   584         // sanity checks

   585         if (log.isLoggable(java.util.logging.Level.FINE)) {

   586             log.log(java.util.logging.Level.FINE, "Initializing XMLCipher...");

   587         }

   588 

   589         ek = null;

   590         ed = null;

   591 

   592         switch (opmode) {

   593 

   594         case ENCRYPT_MODE :

   595             if (log.isLoggable(java.util.logging.Level.FINE)) {

   596                 log.log(java.util.logging.Level.FINE, "opmode = ENCRYPT_MODE");

   597             }

   598             ed = createEncryptedData(CipherData.VALUE_TYPE, "NO VALUE YET");

   599             break;

   600         case DECRYPT_MODE :

   601             if (log.isLoggable(java.util.logging.Level.FINE)) {

   602                 log.log(java.util.logging.Level.FINE, "opmode = DECRYPT_MODE");

   603             }

   604             break;

   605         case WRAP_MODE :

   606             if (log.isLoggable(java.util.logging.Level.FINE)) {

   607                 log.log(java.util.logging.Level.FINE, "opmode = WRAP_MODE");

   608             }

   609             ek = createEncryptedKey(CipherData.VALUE_TYPE, "NO VALUE YET");

   610             break;

   611         case UNWRAP_MODE :

   612             if (log.isLoggable(java.util.logging.Level.FINE)) {

   613                 log.log(java.util.logging.Level.FINE, "opmode = UNWRAP_MODE");

   614             }

   615             break;

   616         default :

   617             log.log(java.util.logging.Level.SEVERE, "Mode unexpectedly invalid");

   618             throw new XMLEncryptionException("Invalid mode in init");

   619         }

   620 

   621         cipherMode = opmode;

   622         this.key = key;

   623     }

   624 

   625     /**

   626      * Set whether secure validation is enabled or not. The default is false.

   627      */

   628     public void setSecureValidation(boolean secureValidation) {

   629         this.secureValidation = secureValidation;

   630     }

   631 

   632     /**

   633      * This method is used to add a custom {@link KeyResolverSpi} to an XMLCipher.

   634      * These KeyResolvers are used in KeyInfo objects in DECRYPT and

   635      * UNWRAP modes.

   636      *

   637      * @param keyResolver

   638      */

   639     public void registerInternalKeyResolver(KeyResolverSpi keyResolver) {

   640         if (internalKeyResolvers == null) {

   641             internalKeyResolvers = new ArrayList<KeyResolverSpi>();

   642         }

   643         internalKeyResolvers.add(keyResolver);

   644     }

   645 

   646     /**

   647      * Get the EncryptedData being built

   648      * <p>

   649      * Returns the EncryptedData being built during an ENCRYPT operation.

   650      * This can then be used by applications to add KeyInfo elements and

   651      * set other parameters.

   652      *

   653      * @return The EncryptedData being built

   654      */

   655     public EncryptedData getEncryptedData() {

   656         // Sanity checks

   657         if (log.isLoggable(java.util.logging.Level.FINE)) {

   658             log.log(java.util.logging.Level.FINE, "Returning EncryptedData");

   659         }

   660         return ed;

   661     }

   662 

   663     /**

   664      * Get the EncryptedData being build

   665      *

   666      * Returns the EncryptedData being built during an ENCRYPT operation.

   667      * This can then be used by applications to add KeyInfo elements and

   668      * set other parameters.

   669      *

   670      * @return The EncryptedData being built

   671      */

   672     public EncryptedKey getEncryptedKey() {

   673         // Sanity checks

   674         if (log.isLoggable(java.util.logging.Level.FINE)) {

   675             log.log(java.util.logging.Level.FINE, "Returning EncryptedKey");

   676         }

   677         return ek;

   678     }

   679 

   680     /**

   681      * Set a Key Encryption Key.

   682      * <p>

   683      * The Key Encryption Key (KEK) is used for encrypting/decrypting

   684      * EncryptedKey elements.  By setting this separately, the XMLCipher

   685      * class can know whether a key applies to the data part or wrapped key

   686      * part of an encrypted object.

   687      *

   688      * @param kek The key to use for de/encrypting key data

   689      */

   690 

   691     public void setKEK(Key kek) {

   692         this.kek = kek;

   693     }

   694 

   695     /**

   696      * Martial an EncryptedData

   697      *

   698      * Takes an EncryptedData object and returns a DOM Element that

   699      * represents the appropriate <code>EncryptedData</code>

   700      * <p>

   701      * <b>Note:</b> This should only be used in cases where the context

   702      * document has been passed in via a call to doFinal.

   703      *

   704      * @param encryptedData EncryptedData object to martial

   705      * @return the DOM <code>Element</code> representing the passed in

   706      * object

   707      */

   708     public Element martial(EncryptedData encryptedData) {

   709         return factory.toElement(encryptedData);

   710     }

   711 

   712     /**

   713      * Martial an EncryptedData

   714      *

   715      * Takes an EncryptedData object and returns a DOM Element that

   716      * represents the appropriate <code>EncryptedData</code>

   717      *

   718      * @param context The document that will own the returned nodes

   719      * @param encryptedData EncryptedData object to martial

   720      * @return the DOM <code>Element</code> representing the passed in

   721      * object

   722      */

   723     public Element martial(Document context, EncryptedData encryptedData) {

   724         contextDocument = context;

   725         return factory.toElement(encryptedData);

   726     }

   727 

   728     /**

   729      * Martial an EncryptedKey

   730      *

   731      * Takes an EncryptedKey object and returns a DOM Element that

   732      * represents the appropriate <code>EncryptedKey</code>

   733      *

   734      * <p>

   735      * <b>Note:</b> This should only be used in cases where the context

   736      * document has been passed in via a call to doFinal.

   737      *

   738      * @param encryptedKey EncryptedKey object to martial

   739      * @return the DOM <code>Element</code> representing the passed in

   740      * object

   741      */

   742     public Element martial(EncryptedKey encryptedKey) {

   743         return factory.toElement(encryptedKey);

   744     }

   745 

   746     /**

   747      * Martial an EncryptedKey

   748      *

   749      * Takes an EncryptedKey object and returns a DOM Element that

   750      * represents the appropriate <code>EncryptedKey</code>

   751      *

   752      * @param context The document that will own the created nodes

   753      * @param encryptedKey EncryptedKey object to martial

   754      * @return the DOM <code>Element</code> representing the passed in

   755      * object

   756      */

   757     public Element martial(Document context, EncryptedKey encryptedKey) {

   758         contextDocument = context;

   759         return factory.toElement(encryptedKey);

   760     }

   761 

   762     /**

   763      * Martial a ReferenceList

   764      *

   765      * Takes a ReferenceList object and returns a DOM Element that

   766      * represents the appropriate <code>ReferenceList</code>

   767      *

   768      * <p>

   769      * <b>Note:</b> This should only be used in cases where the context

   770      * document has been passed in via a call to doFinal.

   771      *

   772      * @param referenceList ReferenceList object to martial

   773      * @return the DOM <code>Element</code> representing the passed in

   774      * object

   775      */

   776     public Element martial(ReferenceList referenceList) {

   777         return factory.toElement(referenceList);

   778     }

   779 

   780     /**

   781      * Martial a ReferenceList

   782      *

   783      * Takes a ReferenceList object and returns a DOM Element that

   784      * represents the appropriate <code>ReferenceList</code>

   785      *

   786      * @param context The document that will own the created nodes

   787      * @param referenceList ReferenceList object to martial

   788      * @return the DOM <code>Element</code> representing the passed in

   789      * object

   790      */

   791     public Element martial(Document context, ReferenceList referenceList) {

   792         contextDocument = context;

   793         return factory.toElement(referenceList);

   794     }

   795 

   796     /**

   797      * Encrypts an <code>Element</code> and replaces it with its encrypted

   798      * counterpart in the context <code>Document</code>, that is, the

   799      * <code>Document</code> specified when one calls

   800      * {@link #getInstance(String) getInstance}.

   801      *

   802      * @param element the <code>Element</code> to encrypt.

   803      * @return the context <code>Document</code> with the encrypted

   804      *   <code>Element</code> having replaced the source <code>Element</code>.

   805      *  @throws Exception

   806      */

   807     private Document encryptElement(Element element) throws Exception{

   808         if (log.isLoggable(java.util.logging.Level.FINE)) {

   809             log.log(java.util.logging.Level.FINE, "Encrypting element...");

   810         }

   811         if (null == element) {

   812             log.log(java.util.logging.Level.SEVERE, "Element unexpectedly null...");

   813         }

   814         if (cipherMode != ENCRYPT_MODE && log.isLoggable(java.util.logging.Level.FINE)) {

   815             log.log(java.util.logging.Level.FINE, "XMLCipher unexpectedly not in ENCRYPT_MODE...");

   816         }

   817 

   818         if (algorithm == null) {

   819             throw new XMLEncryptionException("XMLCipher instance without transformation specified");

   820         }

   821         encryptData(contextDocument, element, false);

   822 

   823         Element encryptedElement = factory.toElement(ed);

   824 

   825         Node sourceParent = element.getParentNode();

   826         sourceParent.replaceChild(encryptedElement, element);

   827 

   828         return contextDocument;

   829     }

   830 

   831     /**

   832      * Encrypts a <code>NodeList</code> (the contents of an

   833      * <code>Element</code>) and replaces its parent <code>Element</code>'s

   834      * content with this the resulting <code>EncryptedType</code> within the

   835      * context <code>Document</code>, that is, the <code>Document</code>

   836      * specified when one calls

   837      * {@link #getInstance(String) getInstance}.

   838      *

   839      * @param element the <code>NodeList</code> to encrypt.

   840      * @return the context <code>Document</code> with the encrypted

   841      *   <code>NodeList</code> having replaced the content of the source

   842      *   <code>Element</code>.

   843      * @throws Exception

   844      */

   845     private Document encryptElementContent(Element element) throws /* XMLEncryption */Exception {

   846         if (log.isLoggable(java.util.logging.Level.FINE)) {

   847             log.log(java.util.logging.Level.FINE, "Encrypting element content...");

   848         }

   849         if (null == element) {

   850             log.log(java.util.logging.Level.SEVERE, "Element unexpectedly null...");

   851         }

   852         if (cipherMode != ENCRYPT_MODE && log.isLoggable(java.util.logging.Level.FINE)) {

   853             log.log(java.util.logging.Level.FINE, "XMLCipher unexpectedly not in ENCRYPT_MODE...");

   854         }

   855 

   856         if (algorithm == null) {

   857             throw new XMLEncryptionException("XMLCipher instance without transformation specified");

   858         }

   859         encryptData(contextDocument, element, true);

   860 

   861         Element encryptedElement = factory.toElement(ed);

   862 

   863         removeContent(element);

   864         element.appendChild(encryptedElement);

   865 

   866         return contextDocument;

   867     }

   868 

   869     /**

   870      * Process a DOM <code>Document</code> node. The processing depends on the

   871      * initialization parameters of {@link #init(int, Key) init()}.

   872      *

   873      * @param context the context <code>Document</code>.

   874      * @param source the <code>Document</code> to be encrypted or decrypted.

   875      * @return the processed <code>Document</code>.

   876      * @throws Exception to indicate any exceptional conditions.

   877      */

   878     public Document doFinal(Document context, Document source) throws /* XMLEncryption */Exception {

   879         if (log.isLoggable(java.util.logging.Level.FINE)) {

   880             log.log(java.util.logging.Level.FINE, "Processing source document...");

   881         }

   882         if (null == context) {

   883             log.log(java.util.logging.Level.SEVERE, "Context document unexpectedly null...");

   884         }

   885         if (null == source) {

   886             log.log(java.util.logging.Level.SEVERE, "Source document unexpectedly null...");

   887         }

   888 

   889         contextDocument = context;

   890 

   891         Document result = null;

   892 

   893         switch (cipherMode) {

   894         case DECRYPT_MODE:

   895             result = decryptElement(source.getDocumentElement());

   896             break;

   897         case ENCRYPT_MODE:

   898             result = encryptElement(source.getDocumentElement());

   899             break;

   900         case UNWRAP_MODE:

   901         case WRAP_MODE:

   902             break;

   903         default:

   904             throw new XMLEncryptionException("empty", new IllegalStateException());

   905         }

   906 

   907         return result;

   908     }

   909 

   910     /**

   911      * Process a DOM <code>Element</code> node. The processing depends on the

   912      * initialization parameters of {@link #init(int, Key) init()}.

   913      *

   914      * @param context the context <code>Document</code>.

   915      * @param element the <code>Element</code> to be encrypted.

   916      * @return the processed <code>Document</code>.

   917      * @throws Exception to indicate any exceptional conditions.

   918      */

   919     public Document doFinal(Document context, Element element) throws /* XMLEncryption */Exception {

   920         if (log.isLoggable(java.util.logging.Level.FINE)) {

   921             log.log(java.util.logging.Level.FINE, "Processing source element...");

   922         }

   923         if (null == context) {

   924             log.log(java.util.logging.Level.SEVERE, "Context document unexpectedly null...");

   925         }

   926         if (null == element) {

   927             log.log(java.util.logging.Level.SEVERE, "Source element unexpectedly null...");

   928         }

   929 

   930         contextDocument = context;

   931 

   932         Document result = null;

   933 

   934         switch (cipherMode) {

   935         case DECRYPT_MODE:

   936             result = decryptElement(element);

   937             break;

   938         case ENCRYPT_MODE:

   939             result = encryptElement(element);

   940             break;

   941         case UNWRAP_MODE:

   942         case WRAP_MODE:

   943             break;

   944         default:

   945             throw new XMLEncryptionException("empty", new IllegalStateException());

   946         }

   947 

   948         return result;

   949     }

   950 

   951     /**

   952      * Process the contents of a DOM <code>Element</code> node. The processing

   953      * depends on the initialization parameters of

   954      * {@link #init(int, Key) init()}.

   955      *

   956      * @param context the context <code>Document</code>.

   957      * @param element the <code>Element</code> which contents is to be

   958      *   encrypted.

   959      * @param content

   960      * @return the processed <code>Document</code>.

   961      * @throws Exception to indicate any exceptional conditions.

   962      */

   963     public Document doFinal(Document context, Element element, boolean content)

   964         throws /* XMLEncryption*/ Exception {

   965         if (log.isLoggable(java.util.logging.Level.FINE)) {

   966             log.log(java.util.logging.Level.FINE, "Processing source element...");

   967         }

   968         if (null == context) {

   969             log.log(java.util.logging.Level.SEVERE, "Context document unexpectedly null...");

   970         }

   971         if (null == element) {

   972             log.log(java.util.logging.Level.SEVERE, "Source element unexpectedly null...");

   973         }

   974 

   975         contextDocument = context;

   976 

   977         Document result = null;

   978 

   979         switch (cipherMode) {

   980         case DECRYPT_MODE:

   981             if (content) {

   982                 result = decryptElementContent(element);

   983             } else {

   984                 result = decryptElement(element);

   985             }

   986             break;

   987         case ENCRYPT_MODE:

   988             if (content) {

   989                 result = encryptElementContent(element);

   990             } else {

   991                 result = encryptElement(element);

   992             }

   993             break;

   994         case UNWRAP_MODE:

   995         case WRAP_MODE:

   996             break;

   997         default:

   998             throw new XMLEncryptionException("empty", new IllegalStateException());

   999         }

  1000 

  1001         return result;

  1002     }

  1003 

  1004     /**

  1005      * Returns an <code>EncryptedData</code> interface. Use this operation if

  1006      * you want to have full control over the contents of the

  1007      * <code>EncryptedData</code> structure.

  1008      *

  1009      * This does not change the source document in any way.

  1010      *

  1011      * @param context the context <code>Document</code>.

  1012      * @param element the <code>Element</code> that will be encrypted.

  1013      * @return the <code>EncryptedData</code>

  1014      * @throws Exception

  1015      */

  1016     public EncryptedData encryptData(Document context, Element element) throws

  1017         /* XMLEncryption */Exception {

  1018         return encryptData(context, element, false);

  1019     }

  1020 

  1021     /**

  1022      * Returns an <code>EncryptedData</code> interface. Use this operation if

  1023      * you want to have full control over the serialization of the element

  1024      * or element content.

  1025      *

  1026      * This does not change the source document in any way.

  1027      *

  1028      * @param context the context <code>Document</code>.

  1029      * @param type a URI identifying type information about the plaintext form

  1030      *    of the encrypted content (may be <code>null</code>)

  1031      * @param serializedData the serialized data

  1032      * @return the <code>EncryptedData</code>

  1033      * @throws Exception

  1034      */

  1035     public EncryptedData encryptData(

  1036         Document context, String type, InputStream serializedData

  1037     ) throws Exception {

  1038         if (log.isLoggable(java.util.logging.Level.FINE)) {

  1039             log.log(java.util.logging.Level.FINE, "Encrypting element...");

  1040         }

  1041         if (null == context) {

  1042             log.log(java.util.logging.Level.SEVERE, "Context document unexpectedly null...");

  1043         }

  1044         if (null == serializedData) {

  1045             log.log(java.util.logging.Level.SEVERE, "Serialized data unexpectedly null...");

  1046         }

  1047         if (cipherMode != ENCRYPT_MODE && log.isLoggable(java.util.logging.Level.FINE)) {

  1048             log.log(java.util.logging.Level.FINE, "XMLCipher unexpectedly not in ENCRYPT_MODE...");

  1049         }

  1050 

  1051         return encryptData(context, null, type, serializedData);

  1052     }

  1053 

  1054     /**

  1055      * Returns an <code>EncryptedData</code> interface. Use this operation if

  1056      * you want to have full control over the contents of the

  1057      * <code>EncryptedData</code> structure.

  1058      *

  1059      * This does not change the source document in any way.

  1060      *

  1061      * @param context the context <code>Document</code>.

  1062      * @param element the <code>Element</code> that will be encrypted.

  1063      * @param contentMode <code>true</code> to encrypt element's content only,

  1064      *    <code>false</code> otherwise

  1065      * @return the <code>EncryptedData</code>

  1066      * @throws Exception

  1067      */

  1068     public EncryptedData encryptData(

  1069         Document context, Element element, boolean contentMode

  1070     ) throws /* XMLEncryption */ Exception {

  1071         if (log.isLoggable(java.util.logging.Level.FINE)) {

  1072             log.log(java.util.logging.Level.FINE, "Encrypting element...");

  1073         }

  1074         if (null == context) {

  1075             log.log(java.util.logging.Level.SEVERE, "Context document unexpectedly null...");

  1076         }

  1077         if (null == element) {

  1078             log.log(java.util.logging.Level.SEVERE, "Element unexpectedly null...");

  1079         }

  1080         if (cipherMode != ENCRYPT_MODE && log.isLoggable(java.util.logging.Level.FINE)) {

  1081             log.log(java.util.logging.Level.FINE, "XMLCipher unexpectedly not in ENCRYPT_MODE...");

  1082         }

  1083 

  1084         if (contentMode) {

  1085             return encryptData(context, element, EncryptionConstants.TYPE_CONTENT, null);

  1086         } else {

  1087             return encryptData(context, element, EncryptionConstants.TYPE_ELEMENT, null);

  1088         }

  1089     }

  1090 

  1091     private EncryptedData encryptData(

  1092         Document context, Element element, String type, InputStream serializedData

  1093     ) throws /* XMLEncryption */ Exception {

  1094         contextDocument = context;

  1095 

  1096         if (algorithm == null) {

  1097             throw new XMLEncryptionException("XMLCipher instance without transformation specified");

  1098         }

  1099 

  1100         byte[] serializedOctets = null;

  1101         if (serializedData == null) {

  1102             if (type.equals(EncryptionConstants.TYPE_CONTENT)) {

  1103                 NodeList children = element.getChildNodes();

  1104                 if (null != children) {

  1105                     serializedOctets = serializer.serializeToByteArray(children);

  1106                 } else {

  1107                     Object exArgs[] = { "Element has no content." };

  1108                     throw new XMLEncryptionException("empty", exArgs);

  1109                 }

  1110             } else {

  1111                 serializedOctets = serializer.serializeToByteArray(element);

  1112             }

  1113             if (log.isLoggable(java.util.logging.Level.FINE)) {

  1114                 log.log(java.util.logging.Level.FINE, "Serialized octets:\n" + new String(serializedOctets, "UTF-8"));

  1115             }

  1116         }

  1117 

  1118         byte[] encryptedBytes = null;

  1119 

  1120         // Now create the working cipher if none was created already

  1121         Cipher c;

  1122         if (contextCipher == null) {

  1123             c = constructCipher(algorithm, null);

  1124         } else {

  1125             c = contextCipher;

  1126         }

  1127         // Now perform the encryption

  1128 

  1129         try {

  1130             // The Spec mandates a 96-bit IV for GCM algorithms

  1131             if (AES_128_GCM.equals(algorithm) || AES_192_GCM.equals(algorithm)

  1132                 || AES_256_GCM.equals(algorithm)) {

  1133                 if (random == null) {

  1134                     random = SecureRandom.getInstance("SHA1PRNG");